Secure web forms with autocomplete, CSRF protection, and input sanitization.
npx skills add https://github.com/Bbeierle12/Skill-MCP-Claude --skill form-security
Please help me install this Agent Skill. Skill: form-security Source: https://github.com/Bbeierle12/Skill-MCP-Claude/tree/main/skills/form-security Command: npx skills add https://github.com/Bbeierle12/Skill-MCP-Claude --skill form-security
Web forms, especially those handling sensitive data, are frequent targets for security vulnerabilities like CSRF and XSS, and often fail to integrate with password managers, leading to poor user experience and weak passwords. This Skill provides essential patterns to build secure, compliant, and user-friendly forms, protecting both your users and your application.
autocomplete values for seamless integration with password managers, improving user experience and password strength.SameSite cookies to prevent Cross-Site Request Forgery attacks, safeguarding against malicious requests.autocomplete="current-password" and autocomplete="new-password", CSRF token implementation, and input sanitization to ensure the forms are secure and user-friendly, reducing security risks and development time.Generate a secure React login form with email and password fields, ensuring correct autocomplete attributes, CSRF protection, and XSS prevention.
High-intent search queries and answers about installing and using this skill.
CSRF protection uses token-based validation and SameSite cookies to prevent Cross-Site Request Forgery. Include a unique token with each form submission and validate it server-side; set SameSite=Strict or Lax on session cookies to block cross-site requests from executing malicious form actions.
Use autocomplete="current-password" for login forms and autocomplete="new-password" for registration or password-change forms. These attributes enable password manager integration, improve user experience, and encourage stronger passwords by allowing secure autofill.
XSS prevention combines input sanitization and output encoding. Sanitize user input by removing or escaping dangerous characters and HTML tags; encode output when displaying user data in HTML context to prevent injected scripts from executing.
Yes. Set correct autocomplete attributes, use standard form input elements with name and id attributes, avoid JavaScript that disrupts autofill, and allow paste in password fields. These practices ensure password managers can securely autofill credentials without user friction.
Input sanitization for payment and authentication forms removes or encodes potentially harmful content before processing. Use allowlists to validate expected formats (email, phone, card numbers), escape special characters, and never log sensitive data like passwords or card details.
Forms fail integration when missing proper autocomplete attributes, using non-standard input elements, blocking paste functionality, or employing JavaScript that interferes with autofill. Password managers rely on semantic HTML and standard attributes to detect and populate credential fields reliably.
kissrosecicd-hubMitigate web application security risks with OWASP Top 10 patterns.
marquesfelipEnforce rate limits, lockouts, and MFA on authentication endpoints.
manastalukdarValidates and generates web framework security header configurations.
efekrbasPrevent client-side security vulnerabilities in browser-based applications.